defender.exclusions

$ target-query <path/to/target> -f defender.exclusions

Details

Module	os.windows.defender.MicrosoftDefenderPlugin
Output	records

Module documentation

Plugin that parses artifacts created by Microsoft Defender.

This includes the EVTX logs, as well as recovery of artefacts from the quarantine folder.

Function documentation

Yield Microsoft Defender exclusions from the Registry.